Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,899cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-87974
Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
33RISK
open ↗Referência
CVE-2026-107158
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
33RISK
open ↗Referência
CVE-2026-18038
nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure
33RISK
open ↗Referência
CVE-2026-14870
Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
56RISK
open ↗Referência
CVE-2026-14545
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
48RISK
open ↗Referência
CVE-2026-97315
Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
33RISK
open ↗Referência
CVE-2026-88998
Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN
33RISK
open ↗Referência
CVE-2026-107126
WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
41RISK
open ↗Referência
CVE-2020-3161
Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
100RISK
open ↗Referência
CVE-2020-3187
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability
85RISK
open ↗Referência
CVE-2026-15038
InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
48RISK
open ↗Referência
Zhiyuan OA - arbitrary file upload leading
Seeyon Zhiyuan OA System Path Traversal File Upload
68RISK
open ↗Referência
CVE-2026-116514
itsourcecode Airline Reservation System book_flight.php cross site scripting
33RISK
open ↗Referência
CVE-2026-108972
SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication
33RISK
open ↗Referência
CVE-2018-19913
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
23RISK
open ↗Referência
CVE-2026-108964
SourceCodester Performance Indicator System addproduct.php sql injection
33RISK
open ↗Referência
CVE-2026-116508
TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
48RISK
open ↗Referência
CVE-2013-5578
Buffer overflow in the ToDot method in the WINGRAPHVIZLib.NEATO ActiveX control in WinGraphviz.dll in StarUML allows rem
23RISK
open ↗Referência
CVE-2026-13509
RAGapp Knowledge File files.py FileHandler.remove_file path traversal
33RISK
open ↗Referência
CVE-2026-13504
code-projects Project Management System Mail Compose mail.php cross site scripting
33RISK
open ↗Referência
CVE-2026-13496
itsourcecode Hospital Management System ajaxmedicine.php sql injection
33RISK
open ↗Referência
CVE-2026-13581
Edimax EW-7478APC POST Request formStaDrvSetup os command injection
33RISK
open ↗Referência
CVE-2026-92811
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
41RISK
open ↗Referência
CVE-2013-5672
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.